A personal computer and a modem access to the Internet are all the tools that a computer hacker needs to conduct a cyber attack on a computer system. The rapid growth of a computer-literate population provides millions of people the opportunity to possess skills necessary to conduct a cyber attack. The computer literate population includes recreational hackers who attempt to gain unauthorized electronic access to information and communication systems. These computer hackers are often motivated only by personal fascination with hacking as an interesting game. Criminals, and perhaps organized crime, might also attempt personal financial gain through manipulation of financial or credit accounts or stealing services. Industrial espionage can also be the reason for a cyber attack on a competitor's computer system. Terrorists may attempt to use the computer infrastructure. Other countries may use the computer infrastructure for national intelligence purpose. Finally, there is the prospect of information warfare, which is a broad, orchestrated attempt to disrupt a United States military operation or significant economic activity.
A typical secure computer network has an interface for receiving and transmitting data between the secure network and computers outside the secure network. The interface may be a modem or an Internet Protocol (IP) router. Data received by the modem is sent to a firewall, which is a network security device that only allows data packets from a trusted computer to be routed to specific addresses within the secure computer network. Although the typical firewall is adequate to prevent outsiders from accessing a secure network, hackers and others can often breach a firewall. This can occur by cyber attack where the firewall becomes overwhelmed with requests and errors are made permitting access to an unauthorized user. As can be appreciated, new ways of overcoming the security devices are developed every day. An entry by an unauthorized user into the secure computer network, past the firewall, from outside the secure computer network is an intrusion.
Another type of unauthorized operation is a misuse, which is an unauthorized access from a computer within the secure computer network. In a misuse, the firewall is not breached. Instead, the unauthorized operation occurs from inside the secure computer network. A misuse can be detected when an authorized user performs an unauthorized, or perhaps, infrequent operation, which may raise the suspicion that an authorized user's computer is being misused. For example, an unauthorized user could obtain the password of an authorized user, logon to the secure computer network from the authorized user's computer, and perform operations not typically performed by the authorized user.
Security and intrusion detection systems exist that can determine if a breach of computer security is occurring. Some existing computer security systems have passive audit capabilities. These systems collect audit information from network devices and format those audits for review. Intrusion and misuse of computer systems with these computer security systems cannot, therefore, operate in real-time, or even in near real-time.